How to securely access your home red team lab from outside?

Different ways to securely access your home-based red team lab from the internet.

If you are into cybersecurity, then a lab is most likely a staple item in your household. And if you are learning red teaming then you might be subscribed to multiple labs already and also have a home lab.

Lab subscriptions are usually bundled with a course or a certification. Among other things, they provide the convenience of being able to access the lab from anywhere. However, these subscriptions can get expensive and offer limited flexibility to customize the lab as per your needs.

What if you can build a world class lab in your home and can also access it from anywhere without compromising security? Wouldn’t that be nice and save you some money as well.

In this post, I have listed down three different ways through which you can setup remote access to your home lab, without requiring port forwarding or a static public IP address. They require a little bit of setup but are free to use.

Hold on! I need to tell you something first. Exposing your home network to the internet is not a good idea, in general. Bad things can happen and happen very fast if the remote access is not setup with proper security controls in place. With that being said, I am assuming that you know what you are doing and have the following in place:

• A well-segmented VLAN that hosts the home lab. Devices in this VLAN must not be able to connect with devices in other VLANs and vice-versa.

• A web-based interface to access lab machines. Through this interface you will be able to access all machines in one place, without having to setup RDP or SSH access to each machine from the outside. Apache Guacamole is the go to choice for most people.

• Security monitoring for the lab VLAN. You can use the ELK stack for this.

Here are three different ways you can access your home lab from the internet:

• Tailscale - It is a peer-to-peer VPN solution that uses the WireGuard protocol for creating encrypted connections between devices. It allows you to securely connect to your home-lab devices from anywhere without needing to expose your network to the internet via port forwarding. It does not require a static public IP address.

• Cloudflare Tunnel - It works by creating a secure, outbound-only connection from your home-lab to the Cloudflare network, effectively exposing your local services to the internet without opening inbound ports or exposing your IP address. All traffic between your home-lab and Cloudflare is encrypted using TLS. Additionally, your actual IP address is hidden behind Cloudflare's infrastructure. This also does not require a static public IP address or port forwarding.

• WireGuard - It creates a direct peer-to-peer VPN connection between devices, making it ideal for securely connecting to and managing your home-lab. Setting up WireGuard requires minimal configuration. It can be setup using a static public IP address. However, that is not a requirement. If you don’t have a static public IP address, you combine it with a Dynamic DNS (DDNS) service or a Cloudflare Tunnel.

Red Team Notes
- You can securely access your home lab for the internet by using Tailscale, Cloudflare Tunnel or WireGuard. You do not need a static public IP address or port forwarding for these methods to work. However, the traffic does get routed through intermediary servers. 
- Isolate or segment the lab network and do not expose your home network without proper security controls in place. 

Follow my journey of 100 Days of Red Team on WhatsApp or Discord.